refactor(jwt): support singing method (#10)

Author: scholar7r

jwt/jwt.go

@@ -12,12 +12,14 @@ import (
 // JWT represents a JWT handler using a shared secret and generic claims data.
 type JWT[T any] struct {
 	secret []byte
+	method jwt.SigningMethod
 }
 
 // New creates a new JWT instance using the given secret string.
-func New[T any](secret string) *JWT[T] {
+func New[T any](secret string, method jwt.SigningMethod) *JWT[T] {
 	return &JWT[T]{
 		secret: []byte(secret),
+		method: method,
 	}
 }
 
@@ -31,15 +33,19 @@ type Claims[T any] struct {
 
 // Generate creates and signs a JWT token using the provided claims.
 func (x *JWT[T]) Generate(claims *Claims[T]) (string, error) {
-	v := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	v := jwt.NewWithClaims(x.method, claims)
 
 	return v.SignedString(x.secret)
 }
 
 // Parse parses and validates a JWT token string and returns the claims
 // if the token is valid.
 func (x *JWT[T]) Parse(tokenString string) (*Claims[T], error) {
-	token, err := jwt.ParseWithClaims(tokenString, &Claims[T]{}, func(_ *jwt.Token) (any, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &Claims[T]{}, func(t *jwt.Token) (any, error) {
+		if t.Method.Alg() != x.method.Alg() {
+			return nil, jwt.ErrTokenSignatureInvalid
+		}
+
 		return x.secret, nil
 	})
 	if err != nil {

jwt/jwt_test.go

@@ -13,7 +13,7 @@ type userClaims struct {
 	Name string
 }
 
-var j = mjwt.New[userClaims]("secret")
+var j = mjwt.New[userClaims]("secret", jwt.SigningMethodHS256)
 
 func TestJWT_GenerateAndParse(t *testing.T) {
 	token, err := j.Generate(&mjwt.Claims[userClaims]{
@@ -59,3 +59,20 @@ func TestJWT_ParseInvalid(t *testing.T) {
 		t.Fatalf("expected parsed to be nil, got %+v", parsed)
 	}
 }
+
+func TestJWT_WrongSigningMethod(t *testing.T) {
+	j1 := mjwt.New[userClaims]("secret", jwt.SigningMethodHS256)
+	j2 := mjwt.New[userClaims]("secret", jwt.SigningMethodHS384)
+
+	token, err := j1.Generate(&mjwt.Claims[userClaims]{
+		Data: &userClaims{ID: 1},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = j2.Parse(token)
+	if err == nil {
+		t.Fatal("expected signing method mismatch error")
+	}
+}